The vulnerability is a symlink race condition in rsync’s source tree traversal. An attacker who can influence a parent directory of the source tree can atomically replace a component with a symlink pointing outside the intended transfer root between path resolution and file open operations. This allows the attacker to read files that should not be exposed by the rsync transfer, resulting in inadvertent disclosure of sensitive data. The weakness is a classic race condition (CWE‑367) and uses path traversal (CWE‑59).

The issue affects the rsync project’s rsync program versions earlier than 3.5.0. Specifically, all releases in the 3.4 series and older are vulnerable.

The CVSS score of 5.7 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be able to modify a parent directory of the rsync source tree on the sending side. In environments where such directories are writable by untrusted users, a local or remote attacker could leverage the race condition to disclose the contents of arbitrary files outside the intended transfer root. Therefore, systems that expose rsync source directories to untrusted users face a potential confidentiality risk.